Grav CVE-2026-117604

Requires ALL of: Grav version 1.7.53.3 through 1.7.53.5; the debugger enabled (system.debugger.enabled: true) with the Clockwork provider (the default provider once the debugger is on); AND Grav deployed behind an HTTP reverse proxy on the same server (e.g. nginx or Caddy fronting Apache, Varnish, or a local tunnel agent) so that REMOTE_ADDR presents as loopback (127.0.0.1 or ::1). The specific flaw is the loopback REMOTE_ADDR fallback in Debugger::isDebuggerRequestAuthorized(), which accepts tokenless requests from a loopback peer. Limiting factors that reduce real-world exposure: sites reached directly by the web server with no same-host proxy are NOT exploitable (such requests arrive from the real client IP and receive 403); sites with the debugger disabled are not exposed; and if debugger.censored is enabled, submitted passwords are redacted from stored records (though configuration credentials and other form fields may remain). Configuring system.debugger.token does NOT mitigate on affected versions, because a tokenless request still reaches the vulnerable loopback fallback.

This is a credible, prioritize-this-week issue rather than an inflated high-CVSS score, but its real-world risk is strongly gated by deployment topology. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) correctly captures a network-reachable, low-complexity, unauthenticated read with high confidentiality impact - the GHSA confirms an unauthenticated visitor retrieved an administrator's plaintext login credentials and full system/plugin configuration. However, exploitation is NOT universal: it only applies when the Grav 1.7.53.3-1.7.53.5 debugger is enabled with the Clockwork provider AND Grav sits behind a same-host reverse proxy, so the vector's AV:N/PR:N reflect the worst-case but conditioned deployment. The vuln.today Decision label is 'this_week', consistent with a confirmed-impact information disclosure that is not under known active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no KEV signal is present, so there is no confirmed active exploitation. No SSVC decision fields (exploitation/automatable/technical impact) were supplied beyond the vuln.today priority label. Net: a genuine, high-impact credential-disclosure bug worth remediating promptly, but whose exposure depends on a specific (though common) reverse-proxy deployment pattern plus the debugger being left on.

An administrator logs into a Grav 1.7.53.3-1.7.53.5 site that runs behind an nginx/Caddy/Varnish reverse proxy on the same host with the Clockwork debugger enabled; their login request (including the submitted plaintext password) is stored as a profiler record. An unauthenticated remote attacker then requests /__clockwork/ with no token, and because REMOTE_ADDR is the loopback address of the local proxy, the authorization fallback serves the stored records - exposing the admin credentials and configuration secrets. No public exploit code is referenced, but the reporter verified this reproduction against a stock 1.7.53.5 install.